This invention relates generally to Interactive Connectivity Establishment (ICE) and more particularly to using ICE across restrictive security boundaries such as restrictive Network Address Translator (NAT) boundaries or firewalls.
Endpoints such as Internet Protocol (IP) phones can make multimedia communications such as Voice over IP (VoIP) calls using multimedia session signaling protocols such as Session Initial Protocol (SIP). Devices such as NATs located between two endpoints can prevent the flow of multimedia session signaling protocol messages between the two endpoints. ICE was developed to allow multimedia communications to operate through NATs.
Even though ICE was developed to allow multimedia communications to operate through NATs, ICE is generally used before any multimedia communications whether or not NATs are located between two communicating endpoints. ICE is used because an endpoint is generally unaware of how many, if any, NATs are located between itself and another endpoint.
Briefly, ICE is performed as follows. Initially, two endpoints go through several steps to each establish a Simple Traversal of User Datagram Protocol (UDP) Through NATs (STUN) server. The endpoints then use the local STUN servers to verify communication paths. After the communication paths are verified, the endpoints may exchange multimedia communications.
ICE fails with certain security device configurations for the reasons described in the background section of copending patent application Ser. No. 11/265,596. Briefly, certain security device configurations intercept and drop incoming ICE messages thereby preventing communication path verification. Endpoints behind the security devices are thus unable to establish multimedia communications.
Because of the forgoing limitations, endpoints behind certain security devices are unable to establish multimedia communications. The disclosure that follows solves this and other problems.